Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

81–90 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#81

Post by AdmiralAsshat »

eamann wrote: post #44

Apple has a bug bounty program where they'll legitimately pay you to report bugs directly to them. What's with everyone reporting them to Twitter instead and forgoing the extra cash?

There's a case to be made for public shaming, sometimes. You're leaving it up to Apple to decide whether they want to pay you or not; they might deny the bounty for some reason, while still fixing the bug. Now you get nothing, in addition to having given Apple time to sweep the issue under the carpet and bury it under a change-log with language that heavily downplays the severity (e.g. "CVE - A buffer overflow could cause an application window behind the lockscreen to retain focus".

Posting it on Twitter, however, draws attention to Apple's waning security practices and how such glaring holes manage to slip past their peer review. It sparks public outrage, and may serve as a wake-up call to the company.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#82

Post by dkersten »

TonnyGaric wrote: post #25
theOnliest wrote: post #20

Earlier quoted context omitted.

But this doesn't really need to be responsibly disclosed: it's not something someone can use to get into your machine, but rather a way you could accidentally broadcast your credentials somewhere unexpected. Announcing on Twitter seems more like "hey be careful, make sure your password field is focused."

Yes, you can not get into someone else's Mac. However, what if the last opened application was Terminal? I can think of several scenario where you can do "damage" without logging in—if this bug is real—depending on the last opened application.

So you're going to start typing terminal commands into peoples locked macbooks on the offchance that they've hit this bug and are running a terminal?

Its a flaw that needs to be fixed, for sure, but lets not over-exaggerate the severity as an attack surface. Its much, much more likely that it will cause accidental problems when the owner types something (like in the tweet).

> if this bug is real

Why wouldn't it be? Plenty of people here and on twitter are reporting having hit similar issues (with OS X and even linux, so it doesn't seem completely uncommon).

Re: macOS lock screen: “I just sent my session pass to my whole team”

#84

Post by rootusrootus »

1_2__4 wrote: post #71
malchow wrote: post #31

Not to pile on, but my MBP (with "TouchBar" which will assuredly not exist in another year) is always in clamshell mode and connected to two external LG 4K displays. Whether, on which screen(s), or in what state the Mac wakes each morning is completely random. Sometimes it doesn't wake at all. Sometimes I have artifacts on one screen and a desktop on another screen. The sleep/wake sequence is a complete mess, and it…

Let's all sit and reflect for a moment that Apple was the first (and for a long time, the only) company that used to get sleep/wake "right".

In my experience there have been problems for a while with sleep/wake if you have external monitors. I'm running 10.12 (work computer, no option for 10.13 yet), and I have three monitors connected to my MBP. I had to adopt a ritual about disconnecting the first screen, then lifting the lid a bit to activate the internal display, then disconnect the other two monitors, then close the lid. Otherwise more often than not when I woke my computer up next it would not have a usable desktop -- the dock would be on a nonexistent screen and could not be found. I got pretty used to using spotlight to load terminal and blind type 'sudo reboot'.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#85

Post by Arnt »

notheguyouthink wrote: post #77
lostlogin wrote: post #74

Earlier quoted context omitted.

Hell yes. I wonder wha’s the worst thing someone has done with this? When you hit return and just before the keystroke a pop up comes up and you agree to something you didn’t want. I’ve see a couple of bad ones in the radiology world.

Oh god, popups while you're typing are the worst. I feel like the OS should not even allow it. No idea how to prevent the issue, but I've been caught mid sentence before and accepted installs, upgrades, random popups, etc. Ones from Skype tend to be the most infuriating / scary..

It's not too difficult. a) only the application with keyboard focus gets to open new windows with keyboard focus less than about two seconds after a keystroke (with no intervening mouse activity). b) no keyboard input into a new window for the first second, unless the user clicks there.

We looked into this while I was Trolltech. Decided against doing it for Qt unilaterally, it's really something the system must do, or else it's too annoying.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#86

Post by pixelHD »

malchow wrote: post #31

Not to pile on, but my MBP (with "TouchBar" which will assuredly not exist in another year) is always in clamshell mode and connected to two external LG 4K displays. Whether, on which screen(s), or in what state the Mac wakes each morning is completely random. Sometimes it doesn't wake at all. Sometimes I have artifacts on one screen and a desktop on another screen. The sleep/wake sequence is a complete mess, and it…

Wow, I have similar issue. I have an acer 4k monitor at home with both HDMI and Display Ports. I used to use HDMI before to connect it to my 15inch 2016 MBP, and the mac used to crash very often. Close the mac, and connect the dongle with hdmi? crash. So I'd have to restart the mac, and connect the monitor while keeping it open, and then close. But once i disconnect the monitor - crash.

I then got a usb c/thunderbolt to display port for 4k 60fps, and the issues significantly dropped, but it still occasionally happens.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#87

Post by arprocter »

dawnerd wrote: post #79
malchow wrote: post #31

Not to pile on, but my MBP (with "TouchBar" which will assuredly not exist in another year) is always in clamshell mode and connected to two external LG 4K displays. Whether, on which screen(s), or in what state the Mac wakes each morning is completely random. Sometimes it doesn't wake at all. Sometimes I have artifacts on one screen and a desktop on another screen. The sleep/wake sequence is a complete mess, and it…

Same problems as you, but I disagree on the touchbar. It’s one of the better things Apple has added recently. But holy hell do they need to work on their external monitor support. Yesterday I had one of my monitors randomly go black for a second. I’ve had audio over usbc just not show up anymore and it refusing to see my gigabit ethernet when waking up unless I unplug the actual ethernet cable. Simply amazing this pa…

My iMac seems to get a 169 IP on wake-up about once a week

No problems with my Debian or Win 7 boxes which are presumably on the same switch

Re: macOS lock screen: “I just sent my session pass to my whole team”

#88

Post by csomar »

I'm really bothered. While I had relatively no issues with the fresh OS X update, I'm having a hard time with the iPhone 7 and the new iOS that is supposed to run their flagship device: iPhone 10.

While most of the bugs have disappeared with the recent update, there are still some minor ones that really pisses me off: Screen freezing unresponsively for 30-60 seconds before things get back to control; and music playing randomly (happened a few times. Everything calm. Boom, music starts to play).

I'm pretty sure this mess wasn't here before the update to iOS 11.

Edit: Just found there is a new update. Let's see if they are getting their shit together this time.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#89

Post by jerf »

j_s wrote: post #60
BoorishBears wrote: post #50

Earlier quoted context omitted.

No idea why you wouldn't just make it clear the site will open an inappropriate image when linked from HN DON'T OPEN THAT LINK

Yes hopefully the commenter will edit in time to remove the http:// prefix so that it is not clickable. https://news.ycombinator.com/item?id=11135200 >sirsar: JWZ used to detect the hacker news referrer and redirect all links that originated on hacker news to goatse. Now it's only slightly less graphic

Sorry. Pity. It's actually crammed full of good stuff, which is why I linked it. It's a classic easy-looking problem that gets really hard when you get down in the weeds.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#90

Post by p7IDD243 »

teekert wrote: post #65
breakingcups wrote: post #8

Earlier quoted context omitted.

I knew I shouldn't have picked 'rm -rf /' as a password

Haha, tried that a couple of months back before wanting to do a reinstall. The system stopped me with some warning :) I think it was Arch but could have been Ubuntu or Solus.

Yep, nowadays rm has a failsafe and requires you to add --no-preserve-root argument if you want to force remove the root folder recursively.
Post reply on HN